WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
booking-calendar-and-notification
Published
2025-04-03
Title
Booking Calendar and Notification <= 4.0.3 - Unauthenticated SQL Injection
Slug
booking-calendar-and-notification
Published
2025-04-03
Title
Booking Calendar and Notification <= 4.0.3 - Authentication Bypass
Slug
booking-calendar-contact-form
Published
2015-05-13
Title
Booking Calendar Contact Form <= 1.0.2 - Multiple Authenticated Vulnerabilities
Slug
booking-calendar-contact-form
Published
2016-02-08
Title
Booking Calendar Contact Form < 1.0.24 - XSS & SQL Injection
Slug
booking-calendar-contact-form
Published
2023-07-18
Title
Booking Calendar Contact Form < 1.2.41 - Unauthenticated Reflected Cross-Site Scripting
Slug
booking-calendar-contact-form
Published
2025-01-24
Title
Booking Calendar Contact Form < 1.2.56 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
booking-calendar-contact-form
Published
2025-06-30
Title
Booking Calendar Contact Form < 1.2.59 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
booking-calendar-contact-form
Published
2025-11-21
Title
Booking Calendar Contact Form < 1.2.61 - Missing Authorization to Unauthenticated Arbitrary Booking Confirmation via 'dex_bccf_ipn' Parameter
Slug
booking-calendar-contact-form
Published
2026-04-23
Title
Booking Calendar Contact Form < 1.2.64 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover
Slug
booking-calendar-contact-form
Published
2026-06-15
Title
Booking Calendar Contact Form < 1.0.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
booking-calendar-contact-form
Published
2026-06-15
Title
Booking Calendar Contact Form < 1.1.25 - Unauthenticated Stored Cross-Site Scripting
Slug
booking-calendar-pro
Published
2025-01-06
Title
Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'
Slug
booking-calendar-pro-payment
Published
2022-11-21
Title
Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload
Slug
booking-for-woocommerce
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
booking-for-woocommerce
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
booking-hub
Published
2026-09-01
Title
Booking Hub <= 1.3.1 - Authenticated (Subscriber+) Privilege Escalation
Slug
booking-hub
Published
2026-08-24
Title
Booking Hub - AI-Powered Scheduling, Reservation and Appointment System for WordPress <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation
Slug
booking-manager
Published
2023-04-26
Title
Booking Manager < 2.0.29 - Subscriber+ SSRF
Slug
booking-manager
Published
2023-12-21
Title
Booking Manager < 2.1.6 - Authenticated(Contributor+) SQL Injection via Shortcode
Slug
booking-manager
Published
2025-09-19
Title
Booking Manager < 2.1.15 - Contributor+ Booking Deletion
Slug
booking-manager
Published
2025-11-04
Title
Booking Manager < 2.1.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
booking-manager
Published
2026-05-29
Title
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar < 2.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
booking-manager
Published
2026-09-21
Title
Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR
Slug
booking-manager
Published
2026-09-21
Title
Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)
Slug
booking-package
Published
2021-11-10
Title
Booking Package < 1.5.11 - Reflected Cross-Site Scripting